﻿#pragma once
#include <ntifs.h>
#include "../c28_r3r0_tunnel/c28_r3r0_client/Struct.h"

NTSTATUS MmCopyVirtualMemory(
	IN PEPROCESS FromProcess,
	IN CONST VOID *FromAddress,
	IN PEPROCESS ToProcess,
	OUT PVOID ToAddress,
	IN SIZE_T BufferSize,
	IN KPROCESSOR_MODE PreviousMode,
	OUT PSIZE_T NumberOfBytesCopied
);

//这个结构体无法返回，因为编写的程序是32位的，如果调用方是32位的，返回的时候不知道返回多大的
//typedef struct _MEMORY_BASIC_INFORMATION {
//	PVOID BaseAddress;
//	PVOID AllocationBase;
//	ULONG AllocationProtect;
//	SIZE_T RegionSize;
//	ULONG State;
//	ULONG Protect;
//	ULONG Type;
//} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;

NTSTATUS MemQueryVirtualMemory(PEPROCESS pProcess, ULONG64 VirtualAddr,
	OUT PMyMEMORY_BASIC_INFORMATION pResultInfo);

//获取pte等地址，方便修改属性，实现可读写，修改物理页等操作
ULONG64 MemGetPte(ULONG64 VirtualAddress);

ULONG64 MemGetPde(ULONG64 VirtualAddress);

ULONG64 MemGetPdPte(ULONG64 VirtualAddress);

ULONG64 MemGetPml4(ULONG64 VirtualAddress);

//通过修改pte中可执行位，让标题为读写的实际上可执行
VOID MemSetPageExecute(ULONG64 VirtualAddress, SIZE_T size);

//申请内存，申请时用读写权限，然后再用pde pte修改把读写权限加上去
PVOID MemAllocateMemory(IN ULONG64 pid, SIZE_T size);

//mdl模式映射内存，隐蔽性更高
PVOID MemMapAllocateMemory(IN ULONG64 pid, SIZE_T size);

//采用附加复制体进程的方式，读写目标进程，绕过附加检测
NTSTATUS MemFakeProcessReadMemory(IN ULONG64 pid, ULONG64 baseAddress, PVOID buffer, ULONG64 size);


NTSTATUS MemFakeProcessWriteMemory(IN ULONG64 pid, ULONG64 baseAddress, PVOID buffer, ULONG64 size);